Query VLANS with Cisco configuration example

Similar Questions

• Compatibility of VLAN with Cisco

  Hello

  We just bought 10 x new Netgear switches (all M4100) to add to an existing Cisco infrastructure.

  Simple configuration with only 6 Valns.

  5: Admin, 30: VOIP, 101: management, 100: a set of Workstations, 102: second series of Workstations, 200: IPTV, 400: Internet, 401: Wireless Management

  All I wanted to do was: 2 last ports each switch netgear = T and all the VLANS. I have not identified all ports if I want to use in the appropriate vlan

  101 of VLAN is my Managementt Vlan. (Need to configure inter vlan routing for this to work)

  I only turned on three switches up to now and all three do not work. They work for a while and that packets but do not receive all.

  What I am doing wrong?

  What I need to get rid of the original vlan1 on the netgear?

  Is that what I need config in the STP to make these compatible with Cisco (300 and 400 series) switches.

  I use an optical backbone on Cisco and Netgear switches.

  Sincere greetings,

  OLAF

  Hi Moussa,.

  Thanks for reaching out.

  We got it working.

  Step 1: upgrade to the latest firmware.

  Step 2: Forget the MISTLETOE.

  We had a few questions about the old firmware - causing links to trunk have some incompatibility with their tag and removed the images between Cisco and Netgear brand.

  After the upgrade of the firmware that we had access to "switchport mode access" and "switchport mode trunk" orders fixing the access port and trunking issues.

  Thank you Mr President,

  OLAF

• VLANS with Cisco ASA 5505 and non-Cisco switch

  I have an ASA5505 and a switch Netgear GSM7224 L2 that I try to use together.  I can't grasp how VLANs (or at least how they should be put in place).  When configuring my VLAN on the ASA5505 it seems simple enough, but then on my switch, I thought I'd create just the same VLAN numbers that I used on the SAA and then add the ports that I wanted to use for each VLAN.

  Currently on my ASA, I have the following VLAN configured...

  outside - vlan11 - Port 0/0

  inside - vlan1 - Port 0/1

  dmz_ftp - vlan21 - Port 0/2

  Port of Corp - vlan31 - 0/3

  I need to do the same thing on my switch as well...  On my way, I'm a little confused as to how I need to configure the VLAN.  Below is the screenshot of web GUI...

  

  Note: Normally you can now change the VLAN ID (red), but in this case the default vlan (vlan id 1) may not be changed or deleted, you can does not change its settings.

  Tagged (green), Untagged (purple) and Autodetect (yellow) you must select at least 1.  I'm not sure how to in one place to tell my inner vlan (vlan1).

  I want VLAN1 ports 1-8 on my Netgear switch used alone to talk to interface/0/1 on the ASA5505 port.  I don't want to NOT port 9-24 able to talk to ports 1-8 on the Netgear switch ports OR 0/0, 0/2 - 0 / 7 on the Cisco ASA 5505.

  So, how can I configure my inner Vlan1 on ports 1-8 on the switch?  Do mark, UNTAG, autodetect them?  What about tours?  I've been a bit the impression that I would set up my VLAN on both devices, then trunk port 1 and dedicate this port on both devices to nothing other than the sheath and the security of vlan would then take the packages where they need to go.  Is this the wrong logic?

  Hi Arvo,

  If the port of the ASA is just part of a single VLAN (i.e. e0/0 single door 11 VLAN), this is called an access port. If the port of the ASA had to carry several VLANs, it would constitute a Trunk port.

  To access ports (VLAN unique), you must set the switch corresponding to be unidentified for port this VLAN individual. If you decide to configure a trunk port, then the port of the switch must be set for labelling for each of VLAN who win the trunk.

  For example, ASA I have:

  interface Ethernet0/1
  switchport access vlan 20
  !
  interface Vlan20
  nameif inside
  security-level 100
  ip address 192.168.100.254 255.255.255.0
  

  With the above configuration, the configuration of the switch would look like this (assuming the e0/1 port of the SAA is connected to 0/1 on the switch):

  VLAN 20 - 0/1 = untagged

  If instead you use a trunk port, the config would look like this:

  interface Ethernet0/0
  switchport trunk allowed vlan 10,20
  switchport mode trunk
  !
  interface Vlan10
  nameif outside
  security-level 0
  ip address dhcp setroute
  !
  interface Vlan20
  nameif inside
  security-level 100
  ip address 192.168.100.254 255.255.255.0
  

  Assuming that the ASA e0/0 port is connected to 0/1 on the switch):

  VLAN 10 - 0/1 = tagged
  VLAN 20 - 0/1 = tagged
  

  Hope that helps.

  -Mike

• Using VLANs with Cisco 1240AG

  Hi guys,.

  NIC 1

  I want that all cable customers (PC1 to PC9) in native VLAN 1 and all in VLAN 10 wireless clients.

  

  1. is this a correct network card?

  2. given that all the wireless clients are in the same VLAN, I guess I should configure port F0/10 market as a port of access for VLAN10 and the single trunk port would be F0/0 that goes to the router. And all I have to do is create VLAN 10 access point and map it to an SSID. Am I wrong?

  3. do I need to do any configuration regarding native VLAN 1 on the access point at all?

  Network card 2.

  I want to have customers invited LAN wireless as well.

  

  1. is this a correct network card?

  2 the port configuration of the ethernet switch to which is connected the point access (F0/10) as a TRUNK port?

  3 configure the APs as a trunk port ethernet port?

  4. can you explain these two commands for me?

  AP(config-subif)# interface FastEthernet0.10AP(config-subif)# encapsulation dot1Q 10

  Hello

  Yes you are right!

  If you want to configure only one SSID and only one VLAN, then make the Switchport access and for multiple SSID make as a trunk on the switch and the AP configure interfaces corresponding Sub...

  Here is the doc that i hv written can give you some nice info as well!

  https://supportforums.Cisco.com/docs/doc-14496

  Let me know if that answers your question and please do not forget to note the useful messages!

  Concerning

  Surendra

• Need help with the configuration of the Site with crossed on Cisco ASA5510 8.2 IPSec VPN Client (1)

  Need urgent help in the configuration of the Client VPN IPSec Site with crossed on Cisco ASA5510 - 8.2 (1).

  Here is the presentation:

  

  There are two leased lines for Internet access - a route 1.1.1.1 and 2.2.2.2, the latter being the default Standard, old East for backup.

  I was able to configure the Client VPN IPSec Site

  (1) with access to the outside so that the internal network (172.16.0.0/24) behind the asa

  (2) with Split tunnel with simultaneous assess internal LAN and Internet on the outside.

  But I was not able to make the tradiotional model Hairpinng to work in this scenario.

  I followed every possible suggestions made on this subject in many topics of Discussion but still no luck. Can someone help me here please?

  Here is the race-Conf with Normal Client to Site IPSec VPN configured with no access boarding:

  LIMITATION: Cannot boot into any other image ios for unavoidable reasons, must use 8.2 (1)

  race-conf - Site VPN Customer normal work without internet access/split tunnel

  : ASA Version 8.2 (1) ! ciscoasa hostname domain cisco.campus.com enable the encrypted password xxxxxxxxxxxxxx XXXXXXXXXXXXXX encrypted passwd names of ! interface GigabitEthernet0/0 nameif outside internet1 security-level 0 IP 1.1.1.1 255.255.255.240 ! interface GigabitEthernet0/1 nameif outside internet2 security-level 0 IP address 2.2.2.2 255.255.255.224 ! interface GigabitEthernet0/2 nameif dmz interface security-level 0 IP 10.0.1.1 255.255.255.0 ! interface GigabitEthernet0/3 nameif campus-lan security-level 0 IP 172.16.0.1 255.255.0.0 ! interface Management0/0 nameif CSC-MGMT security-level 100 the IP 10.0.0.4 address 255.255.255.0 ! boot system Disk0: / asa821 - k8.bin boot system Disk0: / asa843 - k8.bin passive FTP mode DNS server-group DefaultDNS domain cisco.campus.com permit same-security-traffic inter-interface permit same-security-traffic intra-interface object-group network cmps-lan the object-group CSC - ip network object-group network www-Interior object-group network www-outside object-group service tcp-80 object-group service udp-53 object-group service https object-group service pop3 object-group service smtp object-group service tcp80 object-group service http-s object-group service pop3-110 object-group service smtp25 object-group service udp53 object-group service ssh object-group service tcp-port port udp-object-group service object-group service ftp object-group service ftp - data object-group network csc1-ip object-group service all-tcp-udp access list INTERNET1-IN extended permit ip host 1.2.2.2 2.2.2.3 access-list extended SCC-OUT permit ip host 10.0.0.5 everything list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq www list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any https eq list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq ssh list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 no matter what eq ftp list of access CAMPUS-LAN extended permitted udp 172.16.0.0 255.255.0.0 no matter what eq field list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq smtp list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq pop3 access CAMPUS-wide LAN ip allowed list a whole access-list CSC - acl note scan web and mail traffic access-list CSC - acl extended permit tcp any any eq smtp access-list CSC - acl extended permit tcp any any eq pop3 access-list CSC - acl note scan web and mail traffic access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 993 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq imap4 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 465

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq www

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq https

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq smtp

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq pop3

  access-list extended INTERNET2-IN permit ip any host 1.1.1.2

  access-list sheep extended ip 172.16.0.0 allow 255.255.0.0 172.16.0.0 255.255.0.0

  access list DNS-inspect extended permit tcp any any eq field

  access list DNS-inspect extended permit udp any any eq field

  access-list extended capin permit ip host 172.16.1.234 all

  access-list extended capin permit ip host 172.16.1.52 all

  access-list extended capin permit ip any host 172.16.1.52

  Capin list extended access permit ip host 172.16.0.82 172.16.0.61

  Capin list extended access permit ip host 172.16.0.61 172.16.0.82

  access-list extended capout permit ip host 2.2.2.2 everything

  access-list extended capout permit ip any host 2.2.2.2

  Access campus-lan_nat0_outbound extended ip 172.16.0.0 list allow 255.255.0.0 192.168.150.0 255.255.255.0

  pager lines 24

  Enable logging

  debug logging in buffered memory

  asdm of logging of information

  Internet1-outside of MTU 1500

  Internet2-outside of MTU 1500

  interface-dmz MTU 1500

  Campus-lan of MTU 1500

  MTU 1500 CSC-MGMT

  IP local pool 192.168.150.2 - 192.168.150.250 mask 255.255.255.0 vpnpool1

  IP check path reverse interface internet2-outside

  IP check path reverse interface interface-dmz

  IP check path opposite campus-lan interface

  IP check path reverse interface CSC-MGMT

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 621.bin

  don't allow no asdm history

  ARP timeout 14400

  interface of global (internet1-outside) 1

  interface of global (internet2-outside) 1

  NAT (campus-lan) 0-campus-lan_nat0_outbound access list

  NAT (campus-lan) 1 0.0.0.0 0.0.0.0

  NAT (CSC-MGMT) 1 10.0.0.5 255.255.255.255

  static (CSC-MGMT, internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255

  Access-group INTERNET2-IN interface internet1-outside

  group-access INTERNET1-IN interface internet2-outside

  group-access CAMPUS-LAN in campus-lan interface

  CSC-OUT access-group in SCC-MGMT interface

  Internet2-outside route 0.0.0.0 0.0.0.0 2.2.2.5 1

  Route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  AAA authentication enable LOCAL console

  Enable http server

  http 10.0.0.2 255.255.255.255 CSC-MGMT

  http 10.0.0.8 255.255.255.255 CSC-MGMT

  HTTP 1.2.2.2 255.255.255.255 internet2-outside

  HTTP 1.2.2.2 255.255.255.255 internet1-outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs set group5

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  Crypto map internet2-outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  crypto internet2-outside_map outside internet2 network interface card

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as

  quit smoking

  ISAKMP crypto enable internet2-outside

  crypto ISAKMP policy 10

  preshared authentication

  aes encryption

  md5 hash

  Group 2

  life 86400

  Telnet 10.0.0.2 255.255.255.255 CSC-MGMT

  Telnet 10.0.0.8 255.255.255.255 CSC-MGMT

  Telnet timeout 5

  SSH 1.2.3.3 255.255.255.240 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet2-outside

  SSH timeout 5

  Console timeout 0

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal VPN_TG_1 group policy

  VPN_TG_1 group policy attributes

  Protocol-tunnel-VPN IPSec

  username ssochelpdesk encrypted password privilege 15 xxxxxxxxxxxxxx

  privilege of encrypted password username administrator 15 xxxxxxxxxxxxxx

  username vpnuser1 encrypted password privilege 0 xxxxxxxxxxxxxx

  username vpnuser1 attributes

  VPN-group-policy VPN_TG_1

  type tunnel-group VPN_TG_1 remote access

  attributes global-tunnel-group VPN_TG_1

  address vpnpool1 pool

  Group Policy - by default-VPN_TG_1

  IPSec-attributes tunnel-group VPN_TG_1

  pre-shared-key *.

  !

  class-map cmap-DNS

  matches the access list DNS-inspect

  CCS-class class-map

  corresponds to the CSC - acl access list

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  CCS category

  CSC help

  cmap-DNS class

  inspect the preset_dns_map dns

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y

  : end

  Adding dynamic NAT for 192.168.150.0/24 on the external interface works, or works the sysopt connection permit VPN

  Please tell what to do here, to pin all of the traffic Internet from VPN Clients.

  That is, that I need clients connected via VPN tunnel, when connected to the internet, should have their addresses IP NAT'ted against the address of outside internet2 network 2.2.2.2 interface, as it happens for the customers of Campus (172.16.0.0/16)

  I am well aware of all involved in here, so please be elaborative in your answers. Please let me know if you need more information about this configuration to respond to my request.

  Thank you & best regards

  MAXS

  
  

  Hello

  If possible, I'd like to see that a TCP connection attempt (e.g. http://www.google.com) in the ASDM logging of the VPN Client when you set up the dynamic NAT for the VPN Pool also.

  I'll try also the command "packet - trace" on the SAA, while the VPN Client is connected to the ASA.

  The command format is

  packet-tracer intput tcp

  That should tell what the SAA for this kind of package entering its "input" interface

  Still can not see something wrong with the configuration (other than the statement of "nat" missing Dynamics PAT)

  -Jouni

• Problem of trunking routing\802.1 Q inter - VLAN SGE2000P - Cisco 2821

  I am to evaluate the EMS and is unable to get routing inter - VLAN to work on aid and the external router via a 802. 1 q trunk. I have a 2821 with 3 secondary interfaces and I use the VLAN 1 as the VLAN native. G0/0 on router is connected to the port of G1 to the port of the EMS. I can create a VLAN and devices in the VLANs can reach devices in their VLAN respective, but they can't get the router IP address to access the other subnets. Currently I have the port connected to the configuration of the router, as a trunk by using VLAN 1, which is not marked. The EMS has the latest firmware and I tried some types of access ports, general & trunk, changed the PVID, nothing has worked for the other ports on the switch. What would have taken two minutes on a Cisco Configuration switch left flabbergasted me, it could be a defective switch? I was not able to find documentation or examples of this configuration scenario.

  For reference, config the router interface:

  G0/0.1

  encapsulation dot1q 1 native

  IP 1.1.1.1 255.255.255.0

  G0/0.2

  encapsulation dot1q 2

  2.2.2.1 IP address 255.255.255.0

  G0/0.3

  encapsulation dot1q 3

  3.3.3.1 IP address 255.255.255.0

  Any help\direction is appreciated.

  Thank you

  Burt

  Burt Hello, good evening,

  Have you included the VLAN 2 and 3 on the trunk port and ensured that they are labeled?  It should be set to tagged.  The Web interface can be confusing with this config / operation.

  Please check this and let me know, and if necessary I'll lab this for you as well.  Please let me know,

  Andrew

• Voice VLAN with SRW224G4P

  Hi all

  I tried to config a vlan voice in this switches for the last 3 hours and for me it's impossible... I know how to do it in a switch IOS but with this switches is a nightmare...

  I have this topology

  PC - telephone to IP - SW1 SRW224G4P - SWCORE SRW2024 - router 2921 CME

  I have this config in my router,

  interface GigabitEthernet0/0

  no ip address

  automatic duplex

  automatic speed

  !

  interface GigabitEthernet0/0.1

  LAN description

  encapsulation dot1Q 1 native

  IP 192.168.5.95 255.255.255.0

  IP virtual-reassembly in

  !

  interface GigabitEthernet0/0.100

  Description VLAN VoIP

  encapsulation dot1Q 100

  IP 192.168.251.1 255.255.255.0

  IP virtual-reassembly in

  !

  SW1 created the VLAN 100 and activated as VLAN VOIP

  The first 3 octes for the mac on my phone is inserted into the Table YES telephony

  Belonging to a VLAN automatic voice is enabled in the port where the phone is attached.

  The port connected to the SWCORE has the vlan configured as labeled 100.

  SWCORE has created the VLAN 100 and activated as VLAN VOIP

  The port connected to SW1 has the vlan configured as labeled 100.

  The port connected to the router CME has the vlan configured as labeled 100.

  If I have another config port in SWCORE with 100 VLAN Tag I can ping from FMC to this host.

  Could be the problem, an error of spread vlan?

  Could someone help me? I'm desperate...

  Thank you in advance.

  Hi David,

  Thank you for the purchase of the switch.

  . Like what, even riding a bike, the switch is actually very easy to set up, if you practice on it...

  You mentioned that you use the 'phone YES picture' I assume you have a SF300 - 24 p or p/n command SRW224G4P-K9-NA.  Please be specific with the models of switches you use.

  Using the old SRW series or refreshed in the kernel SRWxxx-K9 (300 series) switch?

  First of all, make sure that you are using version 1.1.0.73 of the switch firmware. This change now or check that 1.1.0.73 is the active image on the switch.

  The switch has two areas to store the firmware images.  It stores the new firmware in the area of the image unused.  The administration for the firmware update Guide and select new firmware for the next reboot.

  CDP is enabled on the switch when using the new software, did not exist with older firmware, where my insistence to upgrade the firmware.

  ( Personally I would prefer that you have a role of catalyst for switching to your CME ISRG2 application, for purposes of support tech.) But this is the land of freedom..)

  I found the following when I added my SG300 - 28 p to a conscious UC500 of VLAN.

  The UC500 was vlan100 of advertising as a vlan voice, configured by Cisco Configuration Assistant, you could try CCP on your ISR.

  I got an IP phone that is plugged into the port of switch in the G7 and uplink to my UC500 via the Gig27 port.

  What follows in blue is a screenshot of my 300 series switch CLI interface.

  You will notice that the switch already filled both VLAN and port information, the only command that I added was "don't activate any complexity of passwords" and some usernames, including free from the screenshot below.

  the configured basically switch itself.

  -See the establishment of the system-

  Description of the system: 28 ports Gigabit PoE managed switch

  System of the time (days, hours: min: sec): 00, 00:12:04

  Contact system:

  Name of the system: switch4cf17c

  System location:

  System MAC Address: d0:d0:fd:4 c: f1:7 c

  System object ID: 1.3.6.1.4.1.9.6.1.83.28.2

  Fans Status: OK

  -See the version-

  SW version 1.1.0.73 (date, June 19, 2011 time 18:10:49)

  Start the version 1.0.0.4 (April 8, 2010 time 16:37:57)

  HW version V01

  Location of activity IP gateway Type.

  ----------------------- ----------------------- --------

  192.168.10.1 active dhcp

  IP address I / F Type of status

  ------------------- --------- ----------- -----------

  192.168.10.17/24 vlan 1 DHCP valid

  -show ipv6 interface-

  IPv6 is disabled on all interfaces

  -show running-config-

  interface gigabitethernet7

  Storm-control broadcast level 10

  output

  interface gigabitethernet7

  Storm-control include multicast

  output

  interface gi27

  point to point spanning tree-type of link

  output

  database of VLAN

  VLAN 100

  output

  Add a voice vlan Yes-table 0001e3 Siemens_AG_phone___

  Add a voice vlan Yes-table 00036 b Cisco_phone___

  Add a voice vlan Yes-table 00096e Avaya___

  Add a voice vlan Yes-table 000fe2 H3C_Aolynk___

  Add a voice vlan Yes-table 0060 b 9 Philips_and_NEC_AG_phone

  Add a voice vlan Yes-table 00d01e Pingtel_phone___

  VLAN voice Yes-table add Polycom/Veritel_phone___ 00e075

  Add a voice vlan Yes-table 00e0bb 3Com_phone___

  hostname switch4cf17c

  No complexity of passwords allow

  No server snmp Server

  interface gigabitethernet7

  macro description ip_phone_desktop

  output

  interface gigabitethernet27

  description of the macro "pass | valeur_log | switch ".

  output

  interface gigabitethernet7

  ! next order is internal.

  macro auto smartport dynamic_type ip_phone_desktop

  switchport trunk allowed vlan add 100

  output

  interface gigabitethernet27

  ! next order is internal.

  switch dynamic_type macro auto smartport

  switchport trunk allowed vlan add 100

  output

  switch4cf17c #sh cdp nei

  Ability code: R - router, T - bridge Trans, B - road Source bridge

  S switch, H - host, I - IGMP, r - Repeater, P - VoIP phone

  M - managed remote-device, C - CAST phone Port,

  W - two port MAC relay

  Device ID Local time from Port platform capacity ID Adv

  The interface direct worm.

  ----------------- ----------- ---- ------- ---------- ------------ -----------

  SEP503De50F133A gi7 2 158 H P CISCO IP eth0

  Phone

  SPA525G2

  68bdab0fdcfd gi27 2 169 S I Cisco SG gi9

  300 10 P

  (PID:SRW2008P - K9) - VOD

  switch4cf17c #sh vlan

  VLAN name Ports type permission

  ---- ----------------- --------------------------- ------------ -------------

  1 1 article gi1-28, required to Po1 - 8 by default

  100 100 gi7, required permanent gi27

  Automatically numbers which ports need to be listed in VLAN 100.

  I did not switch it was connected to VLAN100. I don't have add vlan100 to the database for VLAN.

  Get the ISR router to announce VLAN100 as a vlan voice.

  Best regards, Dave

• VLAN: ESXi <>- Cisco SG300

  Hey everybody,

  I always try to get the hang of networking with ESXi/vSphere...and I was little confused as I had a configuration problem.

  I have an Intel NUC5i5MYHE with 5.5 ESXi. As he has that one NETWORK card I am configuring a trunk so I can separate groups of ports within the host with the VLAN.

  Cisco SG300 has several VLANs (including: HAND = 10, LAB1 = 20, LAB2 = 30). * 1 is still active but VLAN native = 999 *.

  MAIN are all fair access Ports on VLAN10 (10UP).

  GE22 is a trunk with VLAN 10, 20 and 30 with label (10T, 20T, 30t, 999UP).

  A few groups of host ports ESXi has currently (simply called the VLAN I want installation and set on the VLANs)

  Also, I created the extra VMkernel port with VLAN10 just for wasting his time with (I can't access to this IP address, but after looking at VMK0, I think that I need to add static routes to the bridge?)

  V0 & VMkernel 0 = VLAN 0 (none)

  V10 & VMkernel 1 = VLAN 10

  V20 = VLAN 20

  So, with this configuration, I am unable to access the host via vSphere Client. However, if I put GE22 on SG300 to 10UP (10UP, 20T, 30t) I AM able to access... but is not what I want, right?

  To my knowledge... 0 (none) passes a VLAN while 4095 (all) does not take into account any VLAN tags completely, sending the frame as-is to the customers. (While I would let VMK0 0 (zero) as the correlates directly to my unique NIC physical, right?)

  So... my computer that connects with the vSphere Client Gets VLAN10 penetration tag (access). Switch then forwards Egress GE22 through the trunk to the ESXi host with a labeled VLAN10 framework.

  The framework should be accepted at the VMK0 whatever the tag VLAN and connect or if the frame belonged to another customer sent on the vSwitch... unless I'm confused here somewhere.

  Can someone enlighten me please?

  Thank you

  Basically, you have two options. If native/default of the physical switch port VLAN is set on the Management VLAN, then do not set a VLAN ID on the management VMkernel port group, otherwise the value the VLAN ID on the virtual side. Ultimately that a single point (the physical switch port, or the virtual port group) is responsible for the labelling/close the network frames.

  André

• AnyConnect + possible PSK (pre-shared key) as under with cisco vpn client ikev1 and ikev2

  Is it possible to create a VPN Anyconnect of RA with just the name of user and password + pre-shared key (Group) for the connection, as could do for ikev1 with cisco VPN client? I am running 8.4.X ASA code and looks like tunnel-group commands have 8.2.X somewhat change. If you change the group type of the tunnel for remote access, now there is no option for IKEv2 PSK. This is only available when you choose the type

  Type of TG_TEST FW1 (config) # tunnel - group?

  set up the mode commands/options:
  Site IPSec IPSec-l2l group
  Remote access using IPSec-IPSec-ra (DEPRECATED) group
  remote access remote access (IPSec and WebVPN) group
  WebVPN WebVPN Group (DEPRECATED)

  FW1(config-tunnel-General) # tunnel - group TG_TEST ipsec-attributes
  FW1(config-tunnel-IPSec) #?

  configuration of the tunnel-group commands:
  any required authorization request users to allow successfully in order to
  Connect (DEPRECATED)
  Allow chain issuing of the certificate
  output attribute tunnel-group IPSec configuration
  mode
  help help for group orders of tunnel configuration
  IKEv1 configure IKEv1
  ISAKMP policy configure ISAKMP
  not to remove a pair of attribute value
  by the peer-id-validate Validate identity of the peer using the peer
  certificate
  negotiation to Enable password update in RADIUS RADIUS with expiry
  authentication (DEPRECATED)

  FW1(config-tunnel-IPSec) # ikev1?

  the tunnel-group-ipsec mode commands/options:
  pre-shared key associate a key shared in advance with the connection policy

  I'm getting old so I hope that it is not in another complaint curmudgeonly on the loss of functionality. :)

  Many small businesses do not want to invest in the PKI. It is usually a pain to deploy, backup, make redundant, etc..

  But it would be nice to have a bit more security on VPN other than just the connections of username and password.

  If this is not possible, it is possible to configure the Anyconnect customer to IKEv1 with PSK and name at the level of the Group client?

  If this is not possible, WTH did cisco end customer VPN cisco as a choice of VPN connection (other than to get more fresh mail of license)?

  I really hope that something like this exists still!

  THX,

  WR

  You are welcome

  In addition to two factors, you can also do double authentication (ie the two using the user name and password). Each set of credentials can come from a Bank of different identities.

  With this scheme, you can can configure a local user name (common) with password on the SAA (think of it as your analog PSK) and the other be the AD user identification information.

• ISA500 site by site ipsec VPN with Cisco IGR

  Hello

  I tried a VPN site by site work with Openswan and Cisco 2821 router configuration an Ipsec tunnel to site by site with Cisco 2821 and ISA550.

  But without success.

  my config for openswan, just FYI, maybe not importand for this problem

  installation of config

  protostack = netkey

  nat_traversal = yes

  virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%4:!$RIGHT_SUBNET

  nhelpers = 0

  Conn rz1

  IKEv2 = no

  type = tunnel

  left = % all

  leftsubnet=192.168.5.0/24

  right =.

  rightsourceip = 192.168.1.2

  rightsubnet=192.168.1.0/24

  Keylife 28800 = s

  ikelifetime 28800 = s

  keyingtries = 3

  AUTH = esp

  ESP = aes128-sha1

  KeyExchange = ike

  authby secret =

  start = auto

  IKE = aes128-sha1; modp1536

  dpdaction = redΘmarrer

  dpddelay = 30

  dpdtimeout = 60

  PFS = No.

  aggrmode = no

  Config Cisco 2821 for dynamic dialin:

  crypto ISAKMP policy 1

  BA aes

  sha hash

  preshared authentication

  Group 5

  lifetime 28800

  !

  card crypto CMAP_1 1-isakmp dynamic ipsec DYNMAP_1

  !

  access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255

  !

  Crypto ipsec transform-set ESP-AES-SHA1 esp - aes esp-sha-hmac

  crypto dynamic-map DYNMAP_1 1

  game of transformation-ESP-AES-SHA1

  match address 102

  !

  ISAKMP crypto key address 0.0.0.0 0.0.0.0

  ISAKMP crypto keepalive 30 periodicals

  !

  life crypto ipsec security association seconds 28800

  !

  interface GigabitEthernet0/0.4002

  card crypto CMAP_1

  !

  I tried ISA550 a config with the same constelations, but without suggesting.

  Anyone has the same problem?

  And had anyone has a tip for me, or has someone expirense with a site-by-site with ISA550 and Cisco 2821 ipsec tunnel?

  I can successfully establish a tunnel between openswan linux server and the isa550.

  Patrick,

  as you can see on newspapers, the software behind ISA is also OpenSWAN

  I have a facility with a 892 SRI running which should be the same as your 29erxx.

  Use your IOS Config dynmap, penny, you are on the average nomad. If you don't have any RW customer you shoul go on IOS "No.-xauth" after the isakmp encryption key.

  Here is my setup, with roardwarrior AND 2, site 2 site.

  session of crypto consignment

  logging crypto ezvpn

  !

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  lifetime 28800

  !

  crypto ISAKMP policy 2

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  lifetime 28800

  !

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 4

  BA 3des

  md5 hash

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 5

  BA 3des

  preshared authentication

  Group 2

  life 7200

  ISAKMP crypto address XXXX XXXXX No.-xauth key

  XXXX XXXX No.-xauth address isakmp encryption key

  !

  ISAKMP crypto client configuration group by default

  key XXXX

  DNS XXXX

  default pool

  ACL easyvpn_client_routes

  PFS

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac FEAT

  !

  dynamic-map crypto VPN 20

  game of transformation-FEAT

  market arriere-route

  !

  !

  card crypto client VPN authentication list by default

  card crypto VPN isakmp authorization list by default

  crypto map VPN client configuration address respond

  10 VPN ipsec-isakmp crypto map

  Description of VPN - 1

  defined peer XXX

  game of transformation-FEAT

  match the address internal_networks_ipsec

  11 VPN ipsec-isakmp crypto map

  VPN-2 description

  defined peer XXX

  game of transformation-FEAT

  PFS group2 Set

  match the address internal_networks_ipsec2

  card crypto 20-isakmp dynamic VPN ipsec VPN

  !

  !

  Michael

  Please note all useful posts

• Disable or wiping "Cisco Configuration Professional Express."

  Hello

  We use a new Cisco1921-SEC/K9 comes with a new IOS (15.2 (4) M1). To use the feature of SSL - VPN from outside we activeted 'secure http server. I tried to check the security of the inside (we use ZBF) and it appeared a "Cisco Configuration Professional Express" Web page with Java "and so on" - brrr - who designed this thing?

  Now us whant to disable or wiping the "Cisco Configuration Professional Express." Subtract the *.pkg and *.cfg flash with charging has not worked.

  How can we remove this 'Cisco Configuration Professional Express', because we do not like ist! I can't find a flag to config or something in the flash...

  Grüße

  Steve

  Steve,

  You can follow the procedure in the CCP Admin Guide (here) for the withdrawal of CCP.

  TL; DR.? Well (2 c seems to be specific to an AP installation):

  To uninstall the Cisco CP Express Admin View of the router flash memory, perform the following steps:

  Step 1 On the router, go to the directory in which Cisco CP Express Admin View files using this command:

  router# cd flash: 

  Step 2 Use the delete command to remove all Cisco CP Express Admin display the files and folders of the router flash memory.

  

  Note Ensure that you delete the files extracted from the ccpexpress27Admin.tar file and the ccpExpress_ap_express - security.shtml.gz.

  a. remove the home.shtml file:

  router# delete /force /recursive home.shtml 

  b. delete the ccpexp folder:

  router# delete /force /recursive flash:ccpexp 

  c. remove the file ccpExpress_ap_express - security.shtml.gz in the folder ap802-xxxxx-xx.xxx-xxx.xxx/html/level/15/ of the AGP flash memory:

  ap# delete flash:/ap802-ccw7-mx.124-25d.JAX/html/level/15/ccpExpress_ap_express-security.shtml.gz

• Problem with Cisco ACS and different areas

  Hello

  We are conducting currently a problem with Cisco ACS that we put in place, and I'll try to describe:

  We have ACS related directory AD areas, where we have 2 domains and appropriate group mappings.

  Then we have our Cisco switches with the following configuration,

  AAA new-model

  AAA-authentication failure message ^ CCCC

  Failled to authenticate!

  Please IT networks Contact Group for more information.

  ^ C

  AAA authentication login default group Ganymede + local

  AAA authorization exec default group Ganymede + local

  AAA authorization network default group Ganymede + local

  AAA accounting exec default start-stop Ganymede group.

  orders accounting AAA 15 by default start-stop Ganymede group.

  !

  AAA - the id of the joint session

  But the problem is that with the users in a domain, we can authenticate, but not the other. Basically, the question is that when we check on the past of authentication, two authentications are passage and the display of 'Authentic OK', but on the side of the switch, there is a power failure.

  There may be something wrong with the ACS?

  Thank you

  Jorge

  Try increasing the timeout on IOS device using radius-server timeout 10.

  Do we not have journaling enabled on the ACS server remotely?

  -Philou

• Cisco configuration professional

  Hi I downloaded configuration cisco professional, but did not find any installer in the zip file I downloaded from cisco. Zip files included only html files.

  I have read the information on the professional page of cisco configuration file I downloaded should be an installer for example: MSI or *.exe in my mind. Where is he?

  Thank you

  Kind regards

  Totardo

  Most likely, you have downloaded the 'express' package that is intended for installation on the device itself. the office installation package is known as 'pro' and the current version is 2.8.

  Looking for the file name "cisco-config-pro-k9-pkg-2_8-en.zip".

  It can be found here:

  https://software.Cisco.com/download/release.html?mdfid=281795035&SOFTWAR...

• can plan us the Conference from Outlook with Cisco TMS

  Hi team,

  is it possible to provide to the Conference by the prospect with Cisco TMS, we have no license to Exchange provisoning. Y at - it a plugin that can be used with Microsoft outlook.

  Please advise.

  See above for my response, either you need to purchase the license and install / configure Setup

  or you program something yourself.

  I would not exclude that there could be tools external hookin upward on the MSDS as well, but I'm not aware of anything.

  The other way is to do it by politics, rent rooms and is a participant dials up to the

  others or if the meeting is greater everyone connects the mcu...

• SE "There are problems with the configuration of static files in your environment" after the APEX 5 install using Oracle HTTP Server

  There is not much information in the doc around the new configuration of static file.  Someone at - it an example of this dads.conf he file should look similar to static files?  Everything else seems to work fine - it's my only hang up now.

  Thank you!

  Exact pop-up message:

  There are problems with the configuration of static files in your environment.  Please see the section "Configuration static file Support" in the Guide of the Installation Application Express

  I figured it out on my own - the doc has a section "6.5.4 configuration Support for static file" which basically said yes, it is now supported for static files, then a "see also:" link to the dads.conf section, that I'm not good enough to see there are now 2 new parameters in your dads config file...  All is ready!  It works!  YAY!